Skip to content
OpenAdvisories

Product · WebPros

Plesk

14 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

10 results · Clear filters · Feed

  • Critical 9.9
    CVE-2026-68487

    Path traversal in Plesk's Backup Manager causes arbitrary file write as root by an authenticated customer.

    WebPros Plesk
  • Critical 9.9
    CVE-2026-68488

    A Time-of-check Time-of-use (TOCTOU) race condition leading to insecure symlink following in Plesk causes local privile…

    WebPros Plesk
  • Critical 9.0
    CVE-2026-67394

    A critical local privilege escalation via OS command injection vulnerability has been discovered in Plesk for Linux, af…

    WebPros Plesk
  • Critical 9.9
    CVE-2026-65646

    Improper neutralization of special elements in in Plesk's DNS zone management functionality allows remote authenticated…

    WebPros Plesk
  • Critical 9.3
    CVE-2026-64639

    Incorrect database cloning process in Plesk from 18.0.52 before 18.0.79.6 and 18.0.80.2 allows a low-privileged user (c…

    WebPros Plesk
  • Critical 9.9
    CVE-2026-64637

    Improper privilege management in the XML-RPC API of Plesk before 18.0.80, allows an authenticated reseller to obtain an…

    WebPros Plesk
  • Critical 9.9
    CVE-2026-58046

    Improper neutralization in the Plesk XML-RPC API allows a remote authenticated low-privileged user to perform SQL injec…

    WebPros Plesk
  • Critical 9.9
    CVE-2026-56843

    Incorrect authorization in the XML-RPC API of WebPros Plesk before 18.0.78.4 allows a low-privileged authenticated cust…

    WebPros Plesk
  • Critical 9.9
    CVE-2026-48614

    An improper authorization vulnerability in the Plesk XML API allows an authenticated user to inject arbitrary configura…

    WebPros Plesk
  • Critical 9.9
    CVE-2026-44962

    Plesk contains an XPath injection vulnerability in the APS Application Catalog search functionality, where user-supplie…

    WebPros Plesk